T09 · Insecure Skill Coding Practices
Error
- Location
scripts/amazon_monitor_core.py:108- Finding
Unvalidated ASIN Allows Arbitrary Filesystem Path Writes
- Content
View full analysis
2 else None if not asin: print("错误: 请提供ASIN，例如: scrape B0XXXXXXX 10001") return zip_code = sys.argv[3] if len(sys.argv) > 3 else '10001' ``` ### Technical Analysis The `asin` parameter is expected to be a ten-character Amazon identifier, but the application does not enforce that format. Instead, it directly interpolates the supplied value into filesystem paths. Because absolute paths and directory traversal components are accepted, a malicious value can redirect history or chart output outside the intended working directory. For ...[truncated 2360 chars]- Remediation
View remediation
str: normalized = asin.strip().upper() if not ASIN_PATTERN.fullmatch(normalized): raise ValueError("ASIN must contain exactly 10 uppercase letters or digits") return normalized ``` 2. Store generated artifacts under a dedicated application data directory rather than the current working directory: ```python from pathlib import Path DATA_DIR = Path.home() / ".amazon-monitor" / "data" DATA_DIR.mkdir(mode=0o700, parents=True, exist_ok=True) ``` 3. Resolve and verify every generated path before opening it: ```python def safe_output_path(filename: str) -> Path: base = DATA_DIR.resolve() destination = (base / filename).resolve() if destination.parent != base: raise ValueError("Output path escapes the data directory") return destination ``` 4. Use only the validated ASIN when generating filenames: ```python safe_asin = validate_asin(asin) json_file = safe_output_path(f"{safe_asin}_history.json") chart_file = safe_output_path(f"{safe_asin}_trend_chart.png") ``` 5. Protect against symbolic-link attacks where local multi-user threat models apply. Use restrictive directory permissions, reject existing symlinks, and consider operating-system APIs supporting no-follow behavior. 6. Write JSON state atomically through a temporary file created inside the dedicated directory, then replace the destination. This reduces corruption risk if the process terminates during a write. 7. Apply the same validation to `scrape`, `monitor`, `run`, `compare`, scheduler operations, and standalone script entry points so invalid identifiers are rejected before any network or filesystem operation. ]]>